Confidentiality

Confidentiality Protecting Personal Information

Definitions • Confidentiality is defined by the International Standards Organization (ISO) as, “ensuring that information is accessible only to those authorized to have access.” • Confidential information is not secret but it is usually information which could be misused.

Examples of Confidential Material • Educational records • Health information • Financial information • Sets of personal identity information (from which a person’s identity could be used by another)

Whose information is confidential? • Students • Employees • Families • Visitors

Educational Records • The Family Educational Rights and Privacy Act (FERPA) requires that school districts and school personnel maintain the confidentiality of any educational records which identify a specific student. • Summary data which is not connected to an individual student is generally open to public access and review under open records laws

Personally Identifiable Information • The student’s name; • The name of the student’s parent or other family member; • The address of the student or student’s family; • A personal identifier, such as the student’s social security number or student number; • A list of personal characteristics that would make the student’s identity easily traceable; • Other information that would make the student’s identity easily traceable.

Need to Know • Confidential information is not secret – it is information that should be limited to those with an educational need-to-know • An educational need-to-know exists when a teacher or other staff member needs access to information to provide appropriate services

Protecting Educational Records • Teachers should keep student records such as grade books in a locked cabinet or drawer when not in use • Teachers should lock classroom doors whenever they leave. This prevents unauthorized persons from accessing records which may be on a desk • Teachers should log off computers to prevent students from using their login to access confidential data

Conversations • Discuss student academic performance, behavior, or health only with those who have a need to know. • Be careful where and when you discuss confidential student information to prevent being overheard; do not discuss students outside the school setting.

Formal Educational Records • The formal student record file is confidential • Each access, by anyone other than the custodian of records, must be logged • Many records are kept electronically, so teachers and other personnel must protect user names and passwords to reduce the risk of authorized accounts being used by unauthorized persons

Educational Records Questions • Direct questions about student records to the campus “custodian of records.” • Direct questions about special education records to the diagnostic specialist.

Health Information • Health information for everyone (not just students but parents and co-workers as well) is protected by federal and state statutes. • Confidential health information is defined by statute and not common practice. • Health information can be shared with those who have a legitimate need-to-know .

Awareness Lists • When health information is shared it should be limited to those with a need-to-know • Generic health awareness lists, such as a list of students at the school with asthma should be used with caution. • Emergency planning lists should be kept in a secure location or coded to reduce the risk of unauthorized access.

Staff Health Information • Staff health information is confidential , supervisors should not keep health information with the personnel record. • Injury reports and other workers’ compensation data may not be kept in the personnel file. • ADA accommodation records should focus on the specific accommodation, not the disability.

Health Information Questions • Questions about student health information confidentiality should be directed to Health Services. • Questions about personnel health information should be directed to Risk Management.

Financial Information • Financial information that must be protected includes but is not limited to: Social security numbers • Checking account numbers • Credit account numbers • Student ID numbers • Staff ID numbers

Managing Financial Information • Create only what you need; do not make unnecessary secondary copies. • Secure information in a locked drawer, cabinet, or restricted file room. • Be careful when talking about financial information; do not allow the information to be overheard

Computer Security • Protect your user information; do not keep user names and passwords together. • Select a password you can remember; do not write it down and tape it to the keyboard! • Do not let your computer “remember” login information for you! • Logoff whenever you leave your computer.

Protect your Information! • Identifying a person usually requires two pieces of information such as: • Name and Social Security Number • Name and Date of Birth • Student ID and PIN • Staff ID and Password • Do not provide this information in response to unsolicited requests.

Identity Theft • Identity theft is much more than using someone else’s credit card. • Identity theft has been used to access medical care, open accounts, enroll in school, even get a new driver’s license. • Protect your information, protect students, fellow staff members, and patrons personal information!

Protecting Information • Limit what you keep to just what you need; shred what you no longer need! • Keep the parts separately. • Don’t let a machine remember for you. • Lock up confidential information. • Be careful in conversation.

Questions • Direct questions about protecting financial information to Risk Management.

For more information: • Student Records Confidentiality http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html • Medical Information Confidentiality http://www.hhs.gov/ocr/privacy/index.html • Financial Records Confidentiality http://www.ftc.gov/infosecurity • Identity Theft Protection http://www.ftc.gov/bcp/edu/microsites/idtheft

Confidentiality